X.509 Certificate Parser (cpp, written by Claude Code)

--- /dev/null
+++ b/setup.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+# System packages this project needs on a clean Ubuntu machine.
+set -e
+export DEBIAN_FRONTEND=noninteractive
+apt-get update -qq
+apt-get install -y -qq --no-install-recommends libssl-dev

Claude Code wrote this cpp project from the task below. It does not run on a clean Ubuntu 22.04 machine as written.

Task given to the agent:

TASK: X.509 Certificate Parser

Write a program that parses X.509 digital certificates in PEM and DER formats, extracts all fields, validates the certificate chain, and checks expiration status.

FUNCTIONAL REQUIREMENTS:
- Accept a certificate file path as a command-line argument (support both PEM and DER formats, auto-detected)
- Extract and display all certificate fields: version, serial number, issuer, subject, validity period (not before/not after), public key algorithm and size, signature algorithm, and fingerprints (SHA-1, SHA-256)
- Parse all X.509 v3 extensions: Subject Alternative Names (SANs), Key Usage, Extended Key Usage, Basic Constraints, Authority/Subject Key Identifiers, CRL Distribution Points
- Check certificate expiration: report if expired, days until expiration, or days since expiration
- Validate a certificate chain when multiple certificates are provided: verify that each certificate is signed by the next one in the chain
- Support reading certificate bundles (multiple PEM certificates concatenated in one file) and parsing each individually
- Support a --format flag to choose output format: text (default human-readable), json, or csv
- Support fetching and parsing a remote server's certificate via --host flag (given a hostname and optional port)
- Print the parsed certificate details to console in a structured, readable format
- Save the output to a file via --output flag
- If no input is given, generate a self-signed CA certificate and a leaf certificate signed by it, then parse both and demonstrate chain validation
- Handle errors: invalid certificate data, unsupported formats, incomplete chains, and encoding issues

Create a complete C++ project for a clean Ubuntu 22.04 machine with only G++ 12+ and CMake 3.22+ installed. Include:
- Source code
- CMakeLists.txt with all dependencies (direct and transitive) pinned to exact versions
- README.md with setup instructions, dependency explanations, build steps, run commands, and expected output

[
  {
    "category": "underspecification",
    "rule": "signature.missing_system_requirement",
    "source": "failure_signature",
    "excerpt": "Could NOT find OpenSSL, try to set the path to OpenSSL root folder in the"
  },
  {
    "category": "underspecification",
    "rule": "diff.adds_external_environment_requirement",
    "source": "manifest_diff:setup.sh",
    "excerpt": "export DEBIAN_FRONTEND=noninteractive"
  },
  {
    "category": "underspecification",
    "rule": "diff.adds_external_environment_requirement",
    "source": "manifest_diff:setup.sh",
    "excerpt": "apt-get install -y -qq --no-install-recommends libssl-dev"
  }
]

cmake_minimum_required(VERSION 3.22)
project(x509_cert_parser VERSION 1.0.0 LANGUAGES CXX)

set(CMAKE_CXX_STANDARD 17)
set(CMAKE_CXX_STANDARD_REQUIRED ON)
set(CMAKE_CXX_EXTENSIONS OFF)

# ---------------------------------------------------------------------------
# Dependencies
# ---------------------------------------------------------------------------
# OpenSSL (system) — X.509 certificate parsing, cryptographic operations,
#                     and signature verification.
# cxxopts 3.1.1   — Header-only command-line option parser.
# fmt 10.2.1      — Modern C++ formatting library for structured output.
# ---------------------------------------------------------------------------

find_package(OpenSSL REQUIRED)

include(FetchContent)

FetchContent_Declare(
    cxxopts
    GIT_REPOSITORY https://github.com/jarro2783/cxxopts.git
    GIT_TAG        v3.1.1
    GIT_SHALLOW    TRUE
)

FetchContent_Declare(
    fmt
    GIT_REPOSITORY https://github.com/fmtlib/fmt.git
    GIT_TAG        10.2.1
    GIT_SHALLOW    TRUE
)

set(CXXOPTS_BUILD_EXAMPLES OFF CACHE BOOL "" FORCE)
set(CXXOPTS_BUILD_TESTS    OFF CACHE BOOL "" FORCE)
set(FMT_DOC                OFF CACHE BOOL "" FORCE)
set(FMT_TEST               OFF CACHE BOOL "" FORCE)
set(FMT_INSTALL            OFF CACHE BOOL "" FORCE)

FetchContent_MakeAvailable(cxxopts fmt)

# ---------------------------------------------------------------------------
# Executable
# ---------------------------------------------------------------------------

add_executable(x509_cert_parser main.cpp)

target_link_libraries(x509_cert_parser PRIVATE
    OpenSSL::SSL
    OpenSSL::Crypto
    cxxopts::cxxopts
    fmt::fmt
)

if(CMAKE_CXX_COMPILER_ID MATCHES "GNU|Clang")
    target_compile_options(x509_cert_parser PRIVATE -Wall -Wextra -Wpedantic)
endif()

/**
 * X.509 Certificate Parser using OpenSSL, cxxopts, and fmt.
 *
 * Parses X.509 certificates in PEM and DER formats, extracts all fields
 * and extensions, and validates certificate chains.
 *
 * Dependencies:
 *   - OpenSSL (system): X.509 parsing, ASN.1 decoding, signature verification
 *   - cxxopts 3.1.1:    Command-line option parsing
 *   - fmt 10.2.1:       Modern C++ formatting library for output
 */

#include <iostream>
#include <fstream>
#include <sstream>
#include <string>
#include <vector>
#include <memory>
#include <cstring>
#include <iomanip>
#include <algorithm>

#include <openssl/x509.h>
#include <openssl/x509v3.h>
#include <openssl/pem.h>
#include <openssl/bio.h>
#include <openssl/evp.h>
#include <openssl/err.h>
#include <openssl/asn1.h>
#include <openssl/objects.h>

#include <cxxopts.hpp>
#include <fmt/core.h>
#include <fmt/format.h>

// RAII wrappers for OpenSSL types
struct X509Deleter { void operator()(X509* p) { if (p) X509_free(p); } };
struct BIODeleter { void operator()(BIO* p) { if (p) BIO_free_all(p); } };
struct EVP_PKEYDeleter { void operator()(EVP_PKEY* p) { if (p) EVP_PKEY_free(p); } };

using X509Ptr = std::unique_ptr<X509, X509Deleter>;
using BIOPtr = std::unique_ptr<BIO, BIODeleter>;

/**
 * Convert a byte array to a colon-separated hex string.
 */
std::string bytesToHex(const unsigned char* data, size_t len) {
    std::string result;
    result.reserve(len * 2);
    for (size_t i = 0; i < len; i++) {
        result += fmt::format("{:02x}", data[i]);
    }
    return result;
}

/**
 * Convert a byte array to a colon-separated hex fingerprint.
 */
std::string bytesToFingerprintHex(const unsigned char* data, size_t len) {
    std::string result;
    for (size_t i = 0; i < len; i++) {
        if (i > 0) result += ":";
        result += fmt::format("{:02X}", data[i]);
    }
    return result;
}

/**
 * Get the string representation of an ASN1_INTEGER.
 */
std::string asn1IntegerToHex(const ASN1_INTEGER* ai) {
    BIGNUM* bn = ASN1_INTEGER_to_BN(ai, nullptr);
    if (!bn) return "";
    char* hex = BN_bn2hex(bn);
    std::string result(hex);
    OPENSSL_free(hex);
    BN_free(bn);
    for (auto& c : result) c = std::tolower(c);
    return result;
}

/**
 * Get string representation of an ASN1_TIME.
 */
std::string asn1TimeToString(const ASN1_TIME* t) {
    if (!t) return "";
    BIOPtr bio(BIO_new(BIO_s_mem()));
    ASN1_TIME_print(bio.get(), t);
    char* buf = nullptr;
    long len = BIO_get_mem_data(bio.get(), &buf);
    return std::string(buf, len);
}

/**
 * Convert X509_NAME to a formatted string.
 */
std::string nameToString(X509_NAME* name) {
    if (!name) return "";
    BIOPtr bio(BIO_new(BIO_s_mem()));
    X509_NAME_print_ex(bio.get(), name, 0, XN_FLAG_RFC2253);
    char* buf = nullptr;
    long len = BIO_get_mem_data(bio.get(), &buf);
    return std::string(buf, len);
}

/**
 * Convert X509_NAME to a multi-line display string.
 */
std::string nameToDisplayString(X509_NAME* name) {
    if (!name) return "";
    std::string result;
    int count = X509_NAME_entry_count(name);
    for (int i = 0; i < count; i++) {
        X509_NAME_ENTRY* entry = X509_NAME_get_entry(name, i);
        ASN1_OBJECT* obj = X509_NAME_ENTRY_get_object(entry);
        ASN1_STRING* val = X509_NAME_ENTRY_get_data(entry);

        char name_buf[256];
        OBJ_obj2txt(name_buf, sizeof(name_buf), obj, 0);

        unsigned char* utf8 = nullptr;
        int utf8_len = ASN1_STRING_to_UTF8(&utf8, val);
        std::string value;
        if (utf8_len > 0) {
            value = std::string(reinterpret_cast<char*>(utf8), utf8_len);
            OPENSSL_free(utf8);
        }

        if (!result.empty()) result += ", ";
        result += fmt::format("{}={}", name_buf, value);
    }
    return result;
}

/**
 * Get public key information as formatted string.
 */
std::string getPublicKeyInfo(X509* cert) {
    EVP_PKEY* pkey = X509_get0_pubkey(cert);
    if (!pkey) return "Unknown";

    int id = EVP_PKEY_id(pkey);
    int bits = EVP_PKEY_bits(pkey);

    switch (id) {
        case EVP_PKEY_RSA:
            return fmt::format("RSA {} bits", bits);
        case EVP_PKEY_EC:
            return fmt::format("EC {} bits", bits);
        case EVP_PKEY_DSA:
            return fmt::format("DSA {} bits", bits);
        case EVP_PKEY_ED25519:
            return "Ed25519 256 bits";
        case EVP_PKEY_ED448:
            return "Ed448 448 bits";
        default:
            return fmt::format("Unknown ({} bits)", bits);
    }
}

/**
 * Parse and display a single extension.
 */
std::string parseExtensionText(X509_EXTENSION* ext) {
    BIOPtr bio(BIO_new(BIO_s_mem()));
    if (!X509V3_EXT_print(bio.get(), ext, 0, 4)) {
        ASN1_STRING* data = X509_EXTENSION_get_data(ext);
        return bytesToHex(ASN1_STRING_get0_data(data), ASN1_STRING_length(data));
    }
    char* buf = nullptr;
    long len = BIO_get_mem_data(bio.get(), &buf);
    return std::string(buf, len);
}

/**
 * Compute a certificate fingerprint.
 */
std::string computeFingerprint(X509* cert, const EVP_MD* md) {
    unsigned char hash[EVP_MAX_MD_SIZE];
    unsigned int hash_len = 0;
    X509_digest(cert, md, hash, &hash_len);
    return bytesToFingerprintHex(hash, hash_len);
}

/**
 * Load a certificate from a file (PEM or DER).
 */
X509Ptr loadCertificate(const std::string& filePath) {
    BIOPtr bio(BIO_new_file(filePath.c_str(), "r"));
    if (!bio) {
        throw std::runtime_error(fmt::format("Cannot open file: {}", filePath));
    }

    X509* cert = PEM_read_bio_X509(bio.get(), nullptr, nullptr, nullptr);
    if (cert) {
        return X509Ptr(cert);
    }

    // Try DER
    bio.reset(BIO_new_file(filePath.c_str(), "rb"));
    if (!bio) {
        throw std::runtime_error(fmt::format("Cannot reopen file: {}", filePath));
    }

    cert = d2i_X509_bio(bio.get(), nullptr);
    if (cert) {
        return X509Ptr(cert);
    }

    throw std::runtime_error(fmt::format("Unable to parse certificate: {}", filePath));
}

/**
 * Load a chain of certificates from a PEM file.
 */
std::vector<X509Ptr> loadCertificateChain(const std::string& filePath) {
    std::vector<X509Ptr> chain;
    BIOPtr bio(BIO_new_file(filePath.c_str(), "r"));
    if (!bio) {
        throw std::runtime_error(fmt::format("Cannot open chain file: {}", filePath));
    }

    while (true) {
        X509* cert = PEM_read_bio_X509(bio.get(), nullptr, nullptr, nullptr);
        if (!cert) break;
        chain.push_back(X509Ptr(cert));
    }
    ERR_clear_error();

    if (chain.empty()) {
        throw std::runtime_error(fmt::format("No certificates found in: {}", filePath));
    }

    return chain;
}

/**
 * Print certificate details in human-readable format.
 */
void printCertificate(X509* cert, bool verbose) {
    fmt::print("Certificate:\n");
    fmt::print("  Version: {}\n", X509_get_version(cert) + 1);

    const ASN1_INTEGER* serial = X509_get0_serialNumber(cert);
    fmt::print("  Serial Number: {}\n", asn1IntegerToHex(serial));

    int sig_nid = X509_get_signature_nid(cert);
    fmt::print("  Signature Algorithm: {}\n", OBJ_nid2ln(sig_nid));

    fmt::print("  Issuer: {}\n", nameToDisplayString(X509_get_issuer_name(cert)));
    fmt::print("  Subject: {}\n", nameToDisplayString(X509_get_subject_name(cert)));

    fmt::print("  Validity:\n");
    fmt::print("    Not Before: {}\n", asn1TimeToString(X509_get0_notBefore(cert)));
    fmt::print("    Not After:  {}\n", asn1TimeToString(X509_get0_notAfter(cert)));

    fmt::print("  Public Key: {}\n", getPublicKeyInfo(cert));

    // Compute public key fingerprint
    EVP_PKEY* pkey = X509_get0_pubkey(cert);
    if (pkey) {
        unsigned char* der = nullptr;
        int der_len = i2d_PUBKEY(pkey, &der);
        if (der_len > 0) {
            unsigned char hash[EVP_MAX_MD_SIZE];
            unsigned int hash_len = 0;
            EVP_Digest(der, der_len, hash, &hash_len, EVP_sha256(), nullptr);
            fmt::print("  Public Key Fingerprint (SHA-256): {}\n",
                       bytesToFingerprintHex(hash, hash_len));
            OPENSSL_free(der);
        }
    }

    // Extensions
    int ext_count = X509_get_ext_count(cert);
    fmt::print("  Extensions ({}):\n", ext_count);

    for (int i = 0; i < ext_count; i++) {
        X509_EXTENSION* ext = X509_get_ext(cert, i);
        ASN1_OBJECT* obj = X509_EXTENSION_get_object(ext);

        char name_buf[256];
        OBJ_obj2txt(name_buf, sizeof(name_buf), obj, 0);
        bool critical = X509_EXTENSION_get_critical(ext) != 0;

        fmt::print("    {} [{}]:\n", name_buf, critical ? "critical" : "non-critical");

        if (verbose) {
            std::string extText = parseExtensionText(ext);
            // Indent each line
            std::istringstream iss(extText);
            std::string line;
            while (std::getline(iss, line)) {
                fmt::print("      {}\n", line);
            }
        }
    }

    // Fingerprints
    fmt::print("  Fingerprints:\n");
    fmt::print("    SHA-256: {}\n", computeFingerprint(cert, EVP_sha256()));
    fmt::print("    SHA-1:   {}\n", computeFingerprint(cert, EVP_sha1()));
    fmt::print("    MD5:     {}\n", computeFingerprint(cert, EVP_md5()));

    // Signature value
    const ASN1_BIT_STRING* sig = nullptr;
    const X509_ALGOR* alg = nullptr;
    X509_get0_signature(&sig, &alg, cert);
    if (sig && verbose) {
        fmt::print("  Signature Value:\n");
        std::string sigHex = bytesToHex(sig->data, sig->length);
        // Print in rows of 54 hex chars
        for (size_t i = 0; i < sigHex.length(); i += 54) {
            fmt::print("    {}\n", sigHex.substr(i, 54));
        }
    }
}

/**
 * Validate a certificate chain.
 */
void validateChain(const std::vector<X509Ptr>& chain) {
    fmt::print("\nCertificate Chain Validation ({} certificate(s)):\n", chain.size());

    bool allValid = true;

    for (size_t i = 0; i < chain.size(); i++) {
        X509* cert = chain[i].get();
        fmt::print("\n  [{}] Subject: {}\n", i,
                   nameToDisplayString(X509_get_subject_name(cert)));
        fmt::print("      Issuer:  {}\n",
                   nameToDisplayString(X509_get_issuer_name(cert)));

        // Check validity period
        int notBeforeCheck = X509_cmp_current_time(X509_get0_notBefore(cert));
        int notAfterCheck = X509_cmp_current_time(X509_get0_notAfter(cert));

        if (notBeforeCheck > 0) {
            fmt::print("      Validity: FAIL (not yet valid)\n");
            allValid = false;
        } else if (notAfterCheck < 0) {
            fmt::print("      Validity: FAIL (expired)\n");
            allValid = false;
        } else {
            fmt::print("      Validity: OK\n");
        }

        // Verify signature
        if (i < chain.size() - 1) {
            EVP_PKEY* issuer_key = X509_get0_pubkey(chain[i + 1].get());
            int verify_result = X509_verify(cert, issuer_key);
            if (verify_result == 1) {
                fmt::print("      Signature: VALID (verified by certificate [{}])\n", i + 1);
            } else {
                fmt::print("      Signature: INVALID\n");
                allValid = false;
            }

            // Check CA constraint on issuer
            int bc = X509_check_ca(chain[i + 1].get());
            if (bc == 0) {
                fmt::print("      Warning: Issuer at [{}] is not a CA\n", i + 1);
                allValid = false;
            }
        } else {
            // Root: self-signed check
            EVP_PKEY* self_key = X509_get0_pubkey(cert);
            int verify_result = X509_verify(cert, self_key);
            if (verify_result == 1) {
                fmt::print("      Signature: SELF-SIGNED (root)\n");
            } else {
                fmt::print("      Signature: NOT SELF-SIGNED (root verification failed)\n");
                allValid = false;
            }
        }
    }

    fmt::print("\n  Chain Status: {}\n", allValid ? "VALID" : "INVALID");
}

int main(int argc, char* argv[]) {
    cxxopts::Options options("x509_cert_parser",
        "X.509 Certificate Parser - Parses PEM/DER certificates and validates chains");

    options.add_options()
        ("c,cert", "Path to PEM or DER encoded X.509 certificate",
            cxxopts::value<std::string>())
        ("chain", "Optional PEM file with certificate chain for validation",
            cxxopts::value<std::string>()->default_value(""))
        ("v,verbose", "Show verbose output including extension details and signature",
            cxxopts::value<bool>()->default_value("false"))
        ("h,help", "Print usage information");

    options.parse_positional({"cert", "chain"});
    options.positional_help("<certificate_file> [chain_file]");

    try {
        auto result = options.parse(argc, argv);

        if (result.count("help") || !result.count("cert")) {
            fmt::print("{}\n", options.help());
            return result.count("help") ? 0 : 1;
        }

        OpenSSL_add_all_algorithms();
        ERR_load_crypto_strings();

        std::string certFile = result["cert"].as<std::string>();
        bool verbose = result["verbose"].as<bool>();

        fmt::print("Parsing certificate: {}\n\n", certFile);
        X509Ptr cert = loadCertificate(certFile);
        printCertificate(cert.get(), verbose);

        std::string chainFile = result["chain"].as<std::string>();
        if (!chainFile.empty()) {
            auto chain = loadCertificateChain(chainFile);
            validateChain(chain);
        }

        EVP_cleanup();
        ERR_free_strings();

    } catch (const cxxopts::exceptions::exception& e) {
        fmt::print(stderr, "Argument error: {}\n", e.what());
        fmt::print(stderr, "{}\n", options.help());
        return 1;
    } catch (const std::exception& e) {
        fmt::print(stderr, "Error: {}\n", e.what());
        return 1;
    }

    return 0;
}

# X.509 Certificate Parser (C++ - Trial 3)

An X.509 certificate parser using OpenSSL, cxxopts, and fmt that reads PEM and DER encoded certificates, extracts all fields and extensions, and validates certificate chains.

## Dependencies

- **OpenSSL** (system): Industry-standard cryptographic library providing X.509 certificate parsing, ASN.1 decoding, public key operations, and signature verification.
- **cxxopts** (3.1.1): Lightweight header-only C++ command-line option parser for structured argument handling with positional and named parameters.
- **fmt** (10.2.1): Modern C++ formatting library providing safe, fast, and expressive string formatting as an alternative to printf and iostreams.

## Build

```bash
mkdir build && cd build
cmake ..
cmake --build .
```

## Usage

### Parse a single certificate

```bash
./x509_cert_parser certificate.pem
```

### Parse with verbose output (extension details and signature)

```bash
./x509_cert_parser -v certificate.pem
```

### Parse and validate a chain

```bash
./x509_cert_parser certificate.pem chain.pem
```

### Show help

```bash
./x509_cert_parser --help
```

## Features

- Parses PEM and DER encoded X.509 certificates
- Extracts subject, issuer, validity, serial number, and signature algorithm
- Extracts public key information (RSA, EC, DSA, Ed25519, Ed448)
- Displays all standard extensions with human-readable output
- Computes SHA-256, SHA-1, and MD5 fingerprints with colon-separated formatting
- Validates certificate chains with signature verification
- Checks validity periods and CA constraints
- RAII wrappers for safe OpenSSL resource management
- Clean formatted output using fmt library
- Structured CLI using cxxopts with positional and named arguments